Mail.ru: XSS Stored on https://seedr.ru

Site: https://seedr.ru/ OS version: Windows 10 browser: Google chrome Stored cross-site scripting arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. I changed my nickname to a code that demonstrates the...

CVE-2021-37860

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP...

PT-2021-21892 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 5.38 and earlier Description: The issue is related to insufficient sanitization of clipboard contents, allowing a user-assisted attacker to inject arbitrary web script in product deployments where the default Content...

Mattermost 跨站脚本漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. A security vulnerability exists in Mattermost 5.38 and earlier versions, which stems from the application's failure to adequately clean up clipboard content and could be exploited to inject arbitrary Web scripts into produc...

U.S. Dept Of Defense: Subdomain takeover [​████████]

The subdomain ███████ was pointing to an Azure Cloud App domain araz-sp.centralus.cloudapp.azure.com, but that endpoint was not registered. Impact It's extremely vulnerable to attacks as a malicious user could create any web page with any content and host it on the vulnerable domain. This would...

Insufficient Policy Enforcement

Insufficient policy enforcement in Blink in Google Chrome. It allowed a remote attacker to bypass content security policy via a crafted HTML page...

Nextcloud Circles Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Nextcloud Circles, an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from the failure of the product's Content-Security-Policy to properly handle incoming input data in...

CVE-2021-30749

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2021-32782

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...

CVE-2021-32782

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...

Cross site scripting

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...

CVE-2021-32782 Cross-Site Scripting in Nextcloud Circles

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...

CVE-2021-32782

CVE-2021-32782 pertains to Nextcloud Circles and is a stored Cross-Site Scripting (XSS) vulnerability. The issue affects Nextcloud Circles and is mitigated in modern browsers that enforce Content-Security-Policy (CSP); exploitation is noted as not feasible on CSP-compliant browsers, but it remain...

Nextcloud 跨站脚本漏洞

A cross-site scripting vulnerability exists in Nextcloud Circles, an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from the failure of the product's Content-Security-Policy to properly handle incoming input data in...

XSS in Nextcloud Circles

None...

Cross-site Scripting in the femanager TYPO3 extension

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website. Note: If SVG uploads are required, it is recommended to use the TYPO3 extension...

GHSA-F3RF-V9QM-9C89 Cross-site Scripting in the femanager TYPO3 extension

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website. Note: If SVG uploads are required, it is recommended to use the TYPO3 extension...

Ruby on Rails: Content Security Policy is only active for HTML responses but not for image/svg+xml

A vulnerability was discovered in Rails where the Content Security Policy CSP was only applied to HTML responses and not to image/svg+xml responses. This allowed an attacker to execute malicious JavaScript code by uploading a malicious SVG file and sending a link to the victim...

CVE-2021-39161

Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scriptingXSS attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed...

CVE-2021-39161

Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scriptingXSS attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed...